HTTP Headers Analyzer is a free tool that explains HTTP response headers in plain language and checks the ones that protect your site: HSTS, Content-Security-Policy, nosniff, clickjacking protection and Referrer-Policy. It also flags headers that reveal software versions. Paste the headers and everything is analysed in your browser.
How to check your headers
- Get the headers: run
curl -I https://your-site.com, or open your browser’s developer tools, select the page in the Network tab and copy the response headers. - Paste them here.
- Fix anything marked ✗ or !, then check again.
The security headers
- Strict-Transport-Security: after the first visit, browsers always use HTTPS for your site, blocking downgrade attacks. Use at least
max-age=15552000(six months). - Content-Security-Policy: limits where scripts, styles and connections can come from, so an injected script can do little harm.
- X-Content-Type-Options: nosniff: stops browsers guessing file types, which can turn an uploaded file into a script.
- frame-ancestors / X-Frame-Options: stops other sites showing your pages in a hidden frame to trick users into clicking (clickjacking).
- Referrer-Policy: stops full URLs, which may contain private details, from leaking to other sites.
Why paste instead of entering a URL?
Fetching another website’s headers needs a server in the middle, because browsers don’t let pages read other sites’ responses. Pasting keeps the tool entirely local, like every other tool here. To inspect cookies in detail, use the Cookie Parser; to identify the browser behind a request’sUser-Agent header, use the User Agent Parser.
Frequently asked questions
Why do I have to paste the headers?
Fetching another site’s headers requires a server, since browsers block reading other sites’ responses. To keep everything private and local, copy the headers from your browser’s Network tab or run curl -I https://your-site.com.
Which security headers matter most?
Strict-Transport-Security (forces HTTPS), Content-Security-Policy (limits damage from XSS), X-Content-Type-Options: nosniff, protection against framing (clickjacking), and a Referrer-Policy.
Is showing the server version a real risk?
It doesn’t create a vulnerability, but it tells attackers exactly which known flaws to try. Hiding it is quick and removes easy reconnaissance.
Last updated